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Group Art Unit: 2175 

Examiner: Chojnacki, Mellissa M, 
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571-273-8300) on August 31, 2005 

Mohammad S. Rahman 
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Mail Stop Appeal Brief - Patents 
Commissioner for Patents 
P.O, Box 1450 
Alexandria, VA 22313-1450 



APPELLANTS* APPEAL BRIEF 



Sirs: 



Appellants respectfully appeal the final rejection of claims 1-2 1 in the Office Action 
dated January 13, 2005. A Notice of Appeal was timely filed on April 11, 2005. 
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L REAL PARTY IN INTEREST 

The real party in interest is International Business Machines Corp., Annonk, New York, 
assignee of 100% interest of the above-referenced patent application. 

II. RELATED APPEALS AND INTERFERENCES 

There aie no other appeals or interferences known to Appellants, Appellants* legal 
representative or Assignee which would directly affect or be directly affected by or have a 
bearing on the Board's decision in this appeal. 

HI. STATUS OF CLAIMS 

Claims 1-21 aits all the claims pending in the application and are set forth fully in the 
attached appendix. Claims 1-21 were originally filed in the application. A first Office Action 
was issued on May 6, 2004 rejecting claims 1-2L Appellants filed an Amendent under 37 
C.F.R. § hi 1 1 on My 28, 2004 amending the claims K 8 and 15. An after-final Office Action 
was issued on January 13, 2005 rejecting claims 1-2L Appellants filed an Amendent under 37 
C.F.R. § 1 .1 1 6 on March 1, 2005 further amending the claims 1 , 8 and 15> An Advisory Action 
was issued on April 5, 2005 indicating that the proposed amendment filed on March 1, 2005 
would not be entered for purposes of appeal, and that claims 1-21 would remain rejected on prior 
art grounds. Claims 1-21 stand rejected under 35 U.S.C. §102(e) as being anticipated by Sziklai 
et al. (U.S. Patent No. 6,341,287), hereinafter referred to as "Sziklai". 

IV. STATEMENT OF AFTER-FINAL AMENDMENTS 

An after-final Office Action dated January 13, 2005 stated that claims 1-21 were rejected. 
Appellants filed an Amendent under 37 CF.R. §1.116 on March 1 , 2005 amending claims 1, 8 
and 15. An Advisory Action was issued on April 5, 2005 not entering the March 1, 2005 
Amendment for purposes of appeal. The claims shown in the Claims Appendix (Section VIII, 
infra) are shown in their amended form as of the July 28, 2004 Amendment. 

V. SUMMARY OF CLAIMED SUBJECT MATTER 

The Appellants' claimed invention is described in pages 4-16 (paragraphs [001 1] through 
10/015,256 2 
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[0047]) of the specification and shown in Figures 1 through 5 of the application as originally 
filed. The Appellants' invention provides a structure and method for a new and improved 
database management system for security and authorization development tools. 

Specifically, with reference to the claimed subject matter recited in Appellants' 
independent claims 1 and 15 and illustrated in the flowchart of Figure 2 (with reference to the 
components in Figure 1), Appellants' invention provides a method for tracking custom computer 
application development profiles in a data processing system (and a program storage device 
readable by machine, tangibly embodying a program of instructions executable by the machine 
to perform a method for tracking custom computer application development profiles in a data 
processing system), wherein the method comprises creating the profiles with a first database tool 

24 (described on page 8 9 lines 8-19 of the specification as originally filed); gathering 
requirements of the profiles with a second database tool 26 (described on page 8, lines 8-19 of 
the specification as originally filed); tracking modifications of the profiles with a third database 
tool 28 (described on page 8, lines 8-19 of the specification as originally filed); allowing security 
and authorization users access to the profiles (via a Security and Authorization Team Interface 

25 of Figure 1 and described on page 8, lines 8-19 of the specification as originally filed); and 
determining whether breaches in security of the data processing system 20 has occurred in each 
phase of development of a computer application program via the Security and Authorization 
Profile Change Request Database 28 of Figure 1 and described on page 11, lines 19-23 of the 
specification as originally filed. 

With reference to the claimed subject matter recited in Appellants' independent claim 8 
and illustrated in Figure 1 and described on page 5, lines 1-7 and page 8 t line 1 through page 10, 
line 4 of the specification as originally filed, Appellants 7 invention provides a computer system 
(as shown in Figure 5 and described on page 10, lines 5-18 of the specification as originally 
filed) executing a method for tracking custom computer application development profiles in a 
data processing system 20, wherein the system comprises a first database tool 24 (Le., Profile 
Matrix) (described on page 8, lines 2 and 1 1 of the specification as originally filed and Figure 1); 
a second database tool 26 (i.e., Profile Requirement Worksheet tool) (described on page 8, lines 
2 and 12-13 of the specification as originally filed and Figure 1) connected to the first database 
tool 24; a third database tool 28 (i.e., Security and Authorization Profile Change Request 
Database) (described on page 8, lines 3 and 13) connected to the first 24 and second database 

10/015,256 3 
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tool 26 (shown in Figure 1 and described on page 5, lines 5-6 of the specification as originally 
filed); a data bank 22 connected to the first 24, second 26 and third 28 database tool (shown in 
Figure 1 and described on page 5, lines 6-7 of the specification as originally filed); and a security 
and authorization interface 25 connected to the data processing system 20 (shown in Figure I 
and described on page 5 3 lines 6-7 of the specification as originally filed), wherein the first 
database tool 24 comprises a first set of protocols which create the profiles (described on page 5, 
lines 8-9 and page 12, line 3 through page 1 3, line 1 7 of the specification as originally filed), 
wherein the second database tool 26 comprises a second set of protocols which gather 
requirements of the profiles (described on page 5, lines 9-10 and page 13, line 18 through page 
14, line 12 of the specification as originally filed), wherein the third database tool 28 comprises a 
third set of protocols which track modifications of the profiles (described on page 5, lines 10-1 1 
and page 1 1 , line 17 through page 12, line 2 of the specification as originally filed); and wherein 
the third database tool 28 is adapted to determine whether breaches in security of the data 
processing system 20 has occurred in each phase of development of a computer application 
program (described on page 1 5 , lines 4-10). 

With reference to the claimed subject matter recited in Appellants' dependent claims 2, 9, 
and 16, Appellants* invention provides in the step of tracking modifications of the profiles with a 
third database tool 28, the third database tool 28 comprises a Profile Matrix 24, wherein the 
Profile Matrix 24 comprises a data set as described on page 5, lines 19-21 of the specification as 
originally filed. 

Moreover, with reference to the claimed subject matter recited in Appellants' dependent 
claims 3,10, and 17, Appellants' invention provides in the step of tracking modifications of the 
profiles with a third database too 28, the third database tool 28 allows tracking capability of tasks 
required to gather and implement changes to the profiles as described on page 8 ? line 22 through 
page 9, line 8 of the specification as originally filed. 

With reference to the claimed subject matter recited in Appellants' dependent claims 4, 
1 1, and 18, Appellants' invention provides in the step of gathering requirements of the profiles 
with a second database too 26, the second database tool 26 comprises a profile requirement 
worksheet 26, wherein the profi le requirement worksheet (PRW 26 of Figure 1) identifies the 
data as described on page 9, lines 3-5 of the specification as originally filed. 

With reference to the claimed subject matter recited in Appellants' dependent claims 5, 

10/015,256 4 
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12, and 19, Appellants' invention provides in the step of gathering requirements of the profiles 
with a second database tool, the second database tool further identifies authorization objects and 
field values of the profile requirement worksheet necessary to gather the requirements of the 
profiles as described on page 9, lines 3-8 of the specification as originally filed. 

With reference to the claimed subject matter recited in Appellants' dependent claims 6, 

13, and 20, Appellants* invention provides that the step of creating the profiles with a first 
database tool 24 further comprises editing the profiles as described on page 5 lines 1 9-21 of the 
specification as originally filed. 

With reference to the claimed subject matter recited in Appellants' dependent claims 7, 

14, and 21, Appellants' invention provides in the step of creating the profiles with a first 
database tool 24, the first database tool 24 comprises a security and authorization profile change 
request database 28, wherein the security and authorization profile change request database 28 
allows the authorization users and requestors an ability to view documented progress of queries 
of the profiles as described on page 5, lines 12-14 of the specification as originally filed, 

VL GROUNDS OF REJECTION TO BE REVIEWED ON APPEAL 

The issues presented for review by the Board of Patents Appeals and Interferences are 
whether claims 1-21 stand rejected under 35'U.S.C- § 102(e) as being anticipated by Sziklai, et al. 
(U,S, Patent No, 6,341 ,287), hereinafter referred to as Sziklai 

VII. ARGUMENT 

A. The Prior Art Rejections Based on 35 ILS.CL §I03(a) 
1 . The Position in the Office Action 

Claims 1-21 stand rejected under 35 tLS.C. §102(e) as being anticipated by Sziklai (U.S. 
Patent No, 6,341,287). According to the Office Action, as to claim 1 (the Office Action 
inferentially rejects claim 15 based on the same rejection made for claim 1) 7 Sziklai teaches a 
method for tracking custom computer application development profiles in a data processing 
system (See abstract, where "custom computer application" is read on "information on 
operations and requirements concerning an activity or area of business"; also see column 8, lines 
60-65), the method comprising creating the profiles with a first database tool (See column 8, 
lines 25-41, lines 60-67; column 9, lines 1-3, where "profiles" is read on "business operations" 

10/015,256 5 
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also see column 9, lines 13-19); gathering requirements of the profiles with a second database 
tool (See abstract; column 10, lines 24-33, where "disposal of hazardous waste in landfills" is 
used as an example of collecting profile data and regulations); tracking modifications of the 
profiles with a third database tool (See column 8, lines 65-67; column 9 9 lines 1-3; column 32, 
lines 24-34); allowing security and authorization users access to the profiles (See column 9 9 lines 
13-19; column 14, lines 50-58; column 21, lines 65-67); and determining whether breaches in 
security of the data processing system has occurred in each phase of development of a computer 
application program (See abstract; column 9, lines 10-16; column 14, lines 50-62; column 21, 
lines 65-67; column 33, lines 5-10; column 34, lines 1-4). 

As to claims 2, 9, and 16, the Office Action opines that Sziklai teaches wherein in the 
step of tracking modifications of the profiles with a third database tool, the third database tool 
comprises a Profile Matrix, wherein the Profile Matrix comprises a data set (See column 13, 
lines 14-22; column 25, lines 56-67; column 26, lines 1-7); wherein the third database tool 
comprises a Profile Matrix, and wherein the Profile Matrix comprises a data set (See column 13, 
lines 14-22; column 25, lines 56-67; column. 26, lines 1-7); wherein the third database tool 
comprises a Profile Matrix, and wherein the Profile Matrix comprises a data set (See column 13, 
lines 14-22; column 25, lines 56-67; column 26, lines 1-7). 

As to claims 3 7 1 0 7 and 1 7, the Office Action argues that Sziklai teaches wherein in the 
step of tracking modifications of the profiles with a third database tool, the third database tool 
allows tracking capability of tasks required to gather and implement changes to the profiles (See 
abstract; column 7, lines 42-57; column 8, lines 25-41 ; column 9, lines 58-61); wherein the third 
database tool allows tracking capability of tasks required to gather and implement changes to the 
profiles (See abstract; column 7, lines 42-57; column 8 ? lines 25-41; column 9, lines 58-61); 
wherein in the method, the step of tracking modifications of the profiles with a third database 
tool allows tracking capability of tasks required to gather and implement changes to the profiles 
(See abstract; column 7, lines 42-57; column 8, lines 25-41 ; column 9, lines 58-61). 

As to claims 4, 1 1, and 1 8, the Office Action suggests that Sziklai teaches wherein in the 
step of gathering requirements of the profiles with a second database tool, the second database 
tool comprises a profile requirement worksheet, wherein the profile requirement worksheet 
identifies the data (See column 9, lines 32-40, where 'Svorksheet" is read on "worklist"; column 
10, lines 47-53); wherein the second database tool comprises a profile requirement worksheet, 

10/015,256 6 
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and wherein the profile requirement worksheet identifies the data (See column 9, lines 32-40, 
where 86 worksheet" is read on "worklist"; column 10, lines 47-53); wherein the second database 
tool comprises a profile requirement worksheet, and wherein the profile requirement worksheet 
identifies the data (See column 9, lines 32-40, where "worksheet" is read on 'Vorklist"; column 
10, lines 47-53). 

As to claims 5,12, and 1 9, it is the position in the Office Action that Sziklai teaches 
wherein in the step of gathering requirements of the profiles with a second database tool, the 
second database tool further identifies authorization objects and field values of the profile 
requirement worksheet necessary to gather the requirement- of the profiles (See column 1 1, lines 
13-22, lines 28-30; column 21, lines 1 1-1 5); wherein the second database tool further identifies 
authorization objects and field values of the profile requirement worksheet necessary to gather 
the requirements of the profiles (See column 11, lines 13-22, lines 28-30; column 21, lines 11- 
15); wherein the second database tool further identifies authorisation objects and field values of 
the profile requirement worksheet necessary to gather the requirements of the profiles (See 
column 11, lines 13-22, lines 28-30; column 21, lines 1 1-15). 

As to claims 6, 1 3, and 20, the Office Action concludes that Sziklai teaches wherein the 
step of creating the profiles with a first database tool fiirther comprises editing the profiles (See 
column 19, lines 30-32; column 21, lines 21-23); wherein the first database tool edits the profiles 
(See column 19, lines 30-32; column 21, lines 21-23); wherein in the method, the step of creating 
the profiles with a first database tool further comprises editing the profiles (See column 1 9, lines 
30-32; column 21, lines 21-23). 

As to claims 7, 14, and 21, the Office Action indicates that Sziklai teaches wherein in the 
step of creating the profiles with a first database tool, the first database tool comprises a security 
and authorization profile change request database, wherein the security and authorization profile 
change request database allows the authorization users and requestors an ability to view 
documented progress of queries of the profiles (See column 1 1, lines 36-42, where 
"authorization users and requestors 11 * is read on "configuration user"; column 29, lines 63-64; 
column 30, lines 17-25); wherein the first database tool comprises a security and authorization 
profile change request database, and wherein the security and authorization profile change 
request database allows the authorization users and requestors an ability to view documented 
progress of queries of the profiles (See column 1 1, lines 36-42, where "authorization users and 

10/015,256 7 
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requestors" is read on "configuration user 7 '; column 29, lines 63-64; column 30, lines 17-25); 
wherein the first database tool comprises a security and authorization profile change request 
database, and wherein the security and authorization profile change request database allows the 
authorization users and requestors an ability to view documented pTOgress of queries of the 
profiles (See column 1 1, lines 36-42, where "authorization users and requestors" is read on 
"configuration user* 5 ; column 29, lines 63-64; column 30, lines 17-25). 

As to claim 8, the Office Action states that Sziklai teaches a computer system executing a 
method for tracking custom computer application development profiles In a data processing 
system (See abstract, where "custom computer application" is read on 'Information on 
operations and requirements concerning an activity or area of business"; also see column 8, lines 
60-65), the system comprising a first database tool (See abstract; column 32, lines 12-21 ; column 
34, lines 5-8); a second database tool connected to the first database tool (See abstract; column 
32, lines 24-3 1 ; column 34, lines 5-8); a third database tool connected to the first and second 
database tool (See abstract column 32, lines 32-41; column 34, lines 5-8); a data bank connected 
to the first, second and third database tool (See abstract; column 34 ; lines 5-8); and a security and 
authorization interface connected to the data processing system (See column 9, lines 13-19; 
column 14, lines 50-58; column 21, lines 65-67), wherein the first database tool comprises a first 
set of protocols which create the profiles (See column 8, lines 25-41, lines 60-67; column 9, lines 
1-3, where "profiles" is read on business operations"; also see column 9 ? lines 13-19), wherein 
the second database tool comprises a second set of protocols which gather requirements of the 
profiles (See abstract; column 10, lines 24-33, where "disposal of hazardous waste in landfills" is 
used as an example of collecting profile data and regulations); wherein the third database tool 
comprises a third set of protocols which track modifications of the profiles (See column 8, lines 
65-67; column 9, lines 1-3; column 32, lines 24-34); and determining whether breaches in 
security of the data processing system has occurred in each phase of development of a computer 
application program (See abstract; column 9 5 lines 10-16; column 14, lines 50-62; column 21, 
lines 65-67; column 33, lines 5-10; column 34 ? lines 1-4). 

2. The Sziklai Reference 
Sziklai teaches an integrated system for managing changes in regulatory and non- 

10/015,256 8 
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regulatory requirements for business activities at an industrial or commercial facility* Examples 
of applications of this system include environmental, health and safety activities, and food, drug, 
cosmetic, and medical treatment and device activities. The system provides one or more 
databases that contain information on operations and requirements concerning an activity or area 
of business; receives information on regulatory and non-regulatory changes that affect operations 
of the business; converts these changes into changes in data entry forms, data processing and 
analysis procedures, and presentation (by printing, electronic display and/or distribution) of data 
processing and analysis results to selected recipients, without requiring the services of one ox 
more programmers to re-key and/or reformat the items affected by the change; and implements 
receipt of change information and dissemination of data processing and analysis results using the 
facilities of the Internet 

B. Appellants' Position 

1. Independent Claims 1 and 15 

Appellants respectfully traverse the rejections in the Office Action of independent claims 
1 and 15 based on the following discussion- Independent claims 1 and 15 contain features, 
which are patentably distinguishable from the prior art references of record, and in particular 
Sziklai, Specifically, claims 1 and 15 provide, in part, ^^. determining whether breaches in 
security of said data processing system has occurred in each phase of development of a computer 
appljcatipq program," These features are simply not taught or suggested in Sziklai. 

Page 9 of the Office Action admits that Sziklai "does not go into full detail of 
'determining security breaches'". Nonetheless, the Office Action concludes that Sziklai 
sufficiently teaches or anticipates "detemuning whether breaches in security of said data 
processing system has occurred in each phase of development of a computer application 
program " as provided in the claimed invention. It appears that the Examiner has chosen to 
conduct a keyword search in the Sziklai reference looking for any mention of the word 
"security" and has used this to conclude that SzikJai teaches the above feature of the claimed 
invention irrespective of what context Sziklai is using the word "security" in, and how broadly 
the term is being used in Sziklai. As such, Appellants strongly suggest that with respect to the 
determination of security breaches, Sziklai is and should properly be considered a non-enabling 
reference, and thus should not be considered as prior art for the purposes of teaching 

10/015,256 9 
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"deteiroining whether breaches in security of said data processing system has occurred in each 
phase of developmentof a computer application program " 

In fact, case law suggests that non-enabling inventions should not be considered prior art. 
See, e.g., In re Wilder. 429 F.2d 447, 166 USPQ 545, 548 (CORA- 1970) (anticipation 
rejection): 

However, such disclosure may yet be held not to legally anticipate the claimed 
subject matter if it is found not to be sufficiently enabling, in other words, if it 
does not place the subject matter of the claims within the possession of the public. 
See, e,g,, In re LeGrice, 301 R2d 929, 133 USPQ 365 (C.C.P.A. 1962); In re 
Brown , 329 F.2d 1006, 141 USPQ 245 (C.C.P-A. 1964). 

The Federal Circuit went on to provide, 'the prior art must enable one skilled in the art to 
make and use the apparatus or method " Rockwell Int 7 l Corp. v. United States. 147 F,3d 1358, 
47 USPQ 2d 1027, 1032 (Fed. Cir. 1998) (citing Motorola, Inc. v. Interdigital Tech. Corp., 121 
F.3d 1461, 1471, 43 USPQ 2d 1481, 1489 (Fed. Cir. 1997). 

Here, as admitted in the Office Action ($ee page 9), Sziklai does not "does not go into 
full detail of c determining security breaches "\ Thus, Sziklai does not properly enable one 
skilled in the art to make and use the invention in Sziklai for the purposes of the manner and 
approach of determining whether security breaches occur. Furthermore, with respect to 
determining whether security breaches occur, clearly Sziklai does not place the claimed 
invention within the possession of the public as required by well-established and legally binding 
case law. 

Additionally, even if by some inexplicable chance that one of ordinary skill in the art 
would refer to Sziklai and conclude that it sufficiently teaches determining whether security 
breaches occur, it would be a gross stretch of reason that one of ordinary skill in the art would 
conclude that Sziklai sufficiently teaches determining whether breaches in security of a data 
processing system has occurred in each phase of development of a computer application 
program . There is simply no teaching of this aspect or reasonable interpretation of the broad 
non-enabling concepts described in Sziklai of this second aspect of the claimed feature. 

Again, the features relating to security are novel features not taught in Sziklai. 
Specifically, column 9, lines 13-16 of Sziklai only generically refers to the feet that security is an 
important feature in database management. There is no mention of how such an implementation 
of security is to take place, let alone a detennination of when breaches in security occur in the 

10/015,256 10 
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development of a software program (i.e., computer application program). That is, there is 
nothing in this language that suggests that determining whether breaches in security of a data 
processing system has occurred in each phase of development of a computer application 
program . 

Next, column 14, lines 50-58 of Sziklai refer to "lt]he Java security model prevents 
unauthorized tampering'with the client machine using non-authenticated code." However, this 
merely suggests that Sziklai f s system uses a Java framework for preventing unauthorized 
tampering using non-authenticated code. However, this does not suggest, and no logical 
interpretation of this would suggest that the Java framework implemented by Sziklai can 
determine whether security breaches have occurred in all phases of the development of a 
software program . Furthermore, column 21, lines 65-67 of Sziklai once again very generically, 
and in non-enabling language, establishes implementing a security role to grant/restrict access to 
the database. However, there is no teaching of how this is accomplished in the context of 
software development, let alone in what phase of development of the software program this 
occurs. 

This is particularly clear because Sziklai focuses on the application of its system to 
environmental, health and safety activities, and food, drug, cosmetic, and medical treatment and 
device activities, and not computer program (software) development as does the claimed 
invention. In other words, Szikjaf s system is not implementable in a software development 
scheme provided by the claimed invention. Thus, Sziklai' s system is incapable of monitoring all 
phases of software development and determine whether security breaches have occurred, thereby 
clearly establishing the claimed invention novel and patentable over Sziklai. Therefore, Sziklai 
does not teach the elements provided by independent claims 1 and 15, thereby making 
independent claims 1 and 1 5 patentable over Sziklai. Thus, the Appellants respectfully request 
that the rejections to claims 1 and 15 be reconsidered and withdrawn. 

2. Independent Claim 8 

Appellants respectfully traverse the rejections in the Office Action of independent claim 
8 based on the following discussion. Independent claim 8 contains features* which are 
patentably distinguishable firom the prior art references of record, and in particular Sziklai. 
Specifically, claim 8 provides, in part, . . wherein said third database tool is adapted to 

10/015,256 11 
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determine whether breaches, in security of said data processing system has occurred in each 
phase of development of a computer application program." These features are simply not taught 
or suggested in Sziklai. 

Page 9 of the Office Action admits that Sziklai "does not go into full detail of 
'determining security breaches'". Nonetheless, the Office Action concludes that Sziklai 
sufficiently teaches or anticipates t 6 to determine whether breaches in security of said data 
processing system has occurred in each phase of development of a computer application 
program" as provided in the claimed invention. It appears that the Examiner has chosen to 
conduct a keyword search in the Sziklai reference looking for any mention of the word 
"security" and has used this to conclude that Sziklai teaches the above feature of the claimed 
invention irrespective of what context Sziklai is using the word "security" in, and how broadly 
the term is being used in Sziklai. As such, Appellants strongly suggest that with respect to the 
determination of security breaches, Sziklai is and should properly be considered a non-enabling 
reference, and thus should not be considered as prior art for the purposes of teaching 4C to 
determine whether breaches in security of said data processing system has occurred in each 
phase of development of a computer application program." 

In fact, case law suggests that non-enablingr inventions should not be considered prior art. 
See, e.g., In re Wilder, 429 F.2d 447, 166 USPQ 545, 548 (CCP.A. 1970) (anticipation 
rejection): 

However, such disclosure may yet be held not to legally anticipate the claimed 
subject matter if it is found not to be sufficiently enabling, in other words, if it 
does not place the subject matter of the claims within the possession of the public. 
See, e,g„ In re LeOrice. 301 F.2d 929, 133 USPQ 365 (C.CJP.A. 1962); In re 
Brown, 329 R2d 1006, 141 USPQ 245 (C.C.P.A. 1964). 

The Federal Circuit went on to provide, "the prior art must enable one skilled in the art to 
make and use the apparatus or method." Rockwell Int'l Corp. v. United States . 147 F.3d 1358, 
47 USPQ 2d 1027, 1032 (Fed. Cir. 1998) (citing Motorola, Inc. v. Inteidigital Tech, Corp.- 121 
F.3d 1461, 1471. 43 USPQ 2d 1481, 1489 (Fed. Cir. 1997). 

Here, as admitted in the Office Action (see page 9), Sziklai does not "does not go into 
full detail of 'determining security breaches'". Thus, Sziklai does not properly enable one 
skilled in the art to make and use the invention in Sziklai for the purposes of the manner and 
approach of detennining whether security breaches occur. Furthermore, with respect to 

10/015,256 12 
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determining whether security breaches occur, clearly Sziklai does not place the claimed 
invention within the possession of the public as required by well-established and legally binding 
case law. 

Additionally, even if by some inexplicable chance that one of ordinary skill in the art 
would refer to Sziklai and conclude that it sufficiently teaches determining whether security 
breaches occur, it would be a gross stretch of reason that one of ordinary skill in the art would 
conclude that Sziklai sufficiently teaches to determine whether breaches in security of a data 
processing system has occurred in each phase of development of a computer application 
program . There is simply no teaching of this aspect or reasonable interpretation of the broad 
non-enabling concepts described in Sziklai of this second aspect of the claimed feature. 

Again, the features relating to security are novel features not taught in Sziklai. 
Specifically, column 9, lines 13-16 of Sziklai only genetically refers to the fact that security is an 
important feature in database management. There is no mention of how such an implementation 
of security is to take place, let alone a determination of when breaches in security occur in the 
development of a software program (i,e,, computer application program). That is, there is 
nothing in this language that suggests determining whether breaches in security of a data 
processing system has occurred in each phase of development of a computer application 
program. 

Next, column 14, lines 50-58 of Sziklai refer to "[tjhe Java security model prevents 
unauthorized tampering with the client machine using non-authenticated code." However, this 
merely suggests that Sziklai's system uses a Java framework for preventing unauthorized 
tampering using non-authenticated code. However, this does not suggest, and no logical 
inteipretation of this would suggest that the Java framework implemented by Sziklai can 
determine whether security breaches have occurred in all phases of the development of a 
Software program. Furthermore, column 2 1 , lines 65-67 of Sziklai once again very generically, 
and in non-enabJing language, establishes implementing a security role to grant/restrict access to 
the database. However, there is no teaching of how this is accomplished in the context of 
software development, let alone in what phase of development of the software program this 
occurs. 

This is particularly clear because Sziklai focuses on the application of its system to 
environmental, health and safety activities, and food, drug, cosmetic, and medical treatment and 

10/015,256 13 
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device activities, and not computer program (software) development as does the claimed 
invention. In other words, Sziklai's system is not impiementable in a software development 
scheme provided by the claimed invention. Thus, Sziklai' s system is incapable of monitoring all 
phases of software development and determine whether security breaches have occurred, thereby 
clearly establishing the claimed invention novel and patentable over Sziklai. Therefore, Sziklai 
does not teach the elements provided by independent claim 8, thereby making independent 
claims 8 patentable over Sziklai. Thus, the Appellants respectfully request that these rejections 
be reconsidered and withdrawn. 

3. Dependent claims 2, 9, and 16 

Appellants respectfully traverse the rejections in the Office Action of dependent claims 2, 

9, and 16 based on the following discussion. Dependent claims 2, 9 9 and 16 contains features, 
which are patentably distinguishable from the prior art references of record, and in particular 
Sziklai. Specifically, claims 2, 9, and 16 provide, in part, . . said third database tool comprises a 
Profile Matrix, and wher ein said Profile Matrix comprises a data set." These features are simply 
not taught or suggested in Sziklai. The report matrix table 52 of Sziklai merely provides the 
"definitions of matrix reports* 5 (see col. 13, lines 1 5-16 of Sziklai). This is patentably distinct 
from the Appellants' Profile Matrix, which according to page 10 s lines 19-22 of the specification 
as originally filed, provides for the ability to not only track the profile progress of projects 
currently in development and for use in the production environment for company-specific 
internal control audits and certification reviews. Therefore, Sziklai does oot teach the elements 
provided by dependent claims 2, 9, and 16, thereby making dependent claims 2, 9, and 16 
patentable over Sziklai. Thus, the Appellants respectfully request that these rejections be 
reconsidered and withdrawn. 

4, Dependent claims 3, 10, and 17 

Appellants respectfully traverse the rejections in the Office Action of dependent claims 3, 

10, and 17 based on the following discussion. Dependent claims 3, 10, and 17 contains features, 
which are patentably distinguishable from the prior art references of record, and in particular 
Sziklai. Specifically, claims 3, 10, and 17 provide, in part, . said third database tool allows 
t aking capability of tasks required to gather and implement c hances to said p rofiles." These 

10/015,256 14 
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features are simply not taught or suggested in Sziklai. Again it appears that the Examiner has 
partaken in a keyword search of Sziklai to try and find all occurrences of the word "changes" 
While Sziklai discusses managing changes in regulatory and non-regulatory requirements for 
business activities at an industrial or commercial facility (abstract), there is no mention in Sziklai 
of using a database to track the capability of tasks required to gather and implement changes to 
computer application development profiles as does Appellants* claimed invention. Therefore, 
Sziklai does not teach the elements provided by dependent claims 3 7 10, and 17, thereby making 
dependent claims 3, 10, and 17 patentable over Sziklai. Thus, the Appellants respectfully request 
that these rejections be reconsidered and withdrawn, 

5. Dependent claims 4, 11, and IS 

Appellants respectfully traverse the rejections in the Office Action of dependent claims 4, 

11, and 18 based on the following discussion. Dependent claims 4, 1 1, and 18 contains features, 
which arc patentably distinguishable from the prior art references of record, and in particular 
Sziklai. Specifically, claims 4, 1 1 , and 18 provide, in part, *\ . . said second database tool 
comprises a profile requirement worksheet and wherein said profile requirement worksheet 
identifies said data " These features are simply not taught or suggested in Sziklai. Appellants' 
profile requirement worksheet identifies the data in the Profile Matrix. Conversely, in Sziklai, 
the WorkList is created manually in a Set Up WorkList function (as provided in coL 10, lines 54- 
61) "to guide an End User through the tasks involved in recording a sample, tracking the sample 
through a chain-of-custody, printing a management report of all samples submitted for analysis, 
preparing and processing a government report, and printing or otherwise distributing the 
government report on a required government form, or on the Internet, as a document image." 
Thus, there is nothing in Sziklai that suggests using the WorkList to identify data. Therefore, 
Sziklai does not teach the elements provided by dependent claims 4, 1 1, and 18, thereby making 
dependent claims 4, 1 1, and 18 patentable over Sziklai. Thus, the Appellants respectfully request 
that these rejections be reconsidered and withdrawn. 

6. Dependent claims 5, 12, and 19 

Appellants respectfully traverse the rejections in the Office Action of dependent claims 5, 

12, and 19 based on the following discussion. Dependent claims 5, 12, and 19 contains features, 

10/015,256 15 
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which are patentably distinguishable from the prior art references of record, and in particular 
Sziklai, Specifically, claims 5, 12, and 1 9 provide, in part, » said second database tool further 
identifies authorization objects and field values of said profile requirement worksheet necessary 
to gather said requirements of said profiles " These features are simply not taught or suggested 
in Sziklai. The Office Action refers to coL 1 1, lines 13-22, lines 28-30; and col. 21, lines 11-15 
of Sziklai as teaching the above features. However, a closer reading of these sections of Sziklai 
indicate no such features. Specifically, there is no reference to "identifying authorization objects 
and field values of a profile requirement worksheet" or a reasonable equivalence of such 
references. Rather, these sections of Sziklai merely refer to a user making configuration changes 
to a data entry form (such as display width, etc.). Therefore, Sziklai does not teach the elements 
provided by dependent claims 5, 12, and 19, thereby making dependent claims 5, 12, and 19 
patentable over Sziklai. Thus, the Appellants respectfully request that these rejections be 
reconsidered and withdrawn. 

7. Dependent claims 6, 13, and 20 

Appellants respectfully traverse the rejections in the Office Action of dependent claims 6, 
13, and 20 based on the following discussion. Dependent claims 6, 13, and 20 contains features* 
which are patentably distinguishable from the prior art references of record, and in particular 
Sziklai. Specifically, claims 6 and 20 provide, in part, . . said step of creating said profiles with 
a first database tool further comprises editing said profiles." Similarly, claim 13 provides, in 
part, *\ . . said first database tool edits said profiles." These features are simply not taught or 
suggested in Sziklai, The Office Action refers to coL 19, lines 30-32; and col. 21, lines 21-23 of 
Sziklai as teaching the above features. However, a closer reading of these sections of Sziklai 
indicate no such features. Sziklai teaches "edit implements user editing of a report, either 
directly or through selection and use of data entry forms supporting the report" and "edit form 
item implements editing of form fields. A spreadsheet format allows a user to easily re-sequence 
and edit data for single or multiple fields." Hence, there is nothing in Sziklai remotely 
suggesting editing custom computer application development profiles as provided in Appellants' 
claimed invention. Therefore, Sziklai does not teach the elements provided by dependent claims 
6, 13, and 20, thereby making dependent claims 6, 13, and 20 patentable over Sziklai. Thus, the 
Appellants respectfully request that these rejections be reconsidered and withdrawn. 
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3. Dependent claims 7, 14, and 21 

Appellants respectfully traverse the rejections in the Office Action of dependent claims 7, 
14, and 21 based on the following discussion- Dependent claims 7, 14, and 21 contains features, 
which are patentably distinguishable from the prior art references of record, and in particular 
Sziklai. Specifically, claims 7, 14, and 21 provide, in part, . . said first database tool comprises 
a security and authorization profile ch ange request database, wherein said security and 
authorization profile change request database allows said authorization users and requestors an 
ability to view documented progress of queries of said profiles." These features are simply not 
taught or suggested in Sziklai. Again it appears that the Examiner has partaken in a keyword 
search of Sziklai to try and find all occurrences of the word "query". While Sziklai discusses 
using an Advanced Query Builder (coL 11, lines 33-34), there is no mention in Sziklai of 
allowing authorization users and requestors an ability to view a documented progress of queries 
of custom computer application development profiles as does Appellants' claimed invention . 
Therefore, Sziklai does not teach the elements provided by dependent claims 7, 14, and 21 , 
thereby making dependent claims 7, 14, and 21 patentable over Sziklai. Thus, the Appellants 
respectfully request that these rejections be reconsidered and withdrawn. 

C. Conclusion 

In view the forgoing, the Board is respectfully requested to reconsider and withdraw the 
rejections of claims 1-21 . Please charge any deficiencies and credit any overpayments to 
Attorney' s Deposit Account Number 5 0-05 1 0. 

Respectfully submitted, 

Dated: August 31. 2005 



10/015,256 



Mohammad S. Rahman 
Registration No. 43,029 
McGinn & Gibb, P.L.L.C. 
2568-A Riva Road, Suite 304 
Telephone: (301) 261-8625 
Fax: (301) 261-8825 

17 



PAGE 18126 • RCVD AT 9/1/2005 10:45:44 AM [Eastern Daylight Time] * SVR:USPTO-EFXRF-6/28 * DNIS:2738300 * CSID:4105731124 * DURATION (mm-ss):07-54 



08/31/2005 22:44 4105731124 



MCGINN&GIBB 



PAGE 19 




Annapolis, MD 21401 
Customer Number: 29154 




10/015,256 18 BEST AVAILABLE COPY 

PAGE 19/26 * RCVD AT 9/1/2005 10:45:44 AM [Eastern Daylight Time] * SVR:USPTO-EFXRF-6/28 " DN1S:2738300 * CSID:4105731124 * DURATION (mm-ss);07-54 



08/31/2085 22:44 4105731124 



MCGINN&GIBB 



PAGE 20 



Vm. CLAIMS APPENDIX 

1 . (Previously Presented) A method for tracking custom computer application development 
profiles in a data processing system, said method comprising: 

creating said profiles with a first database tool; 

gathering requirements of said profiles with a second database tool; 

tracking modifications of said profiles with a third database tool; 

allowing security and authorization users access to said profiles; and 

determining whether breaches in security of said data processing system has occurred in 
each phase of development of a computer application program- 





2, (Original) The method of claim 1 , wherein in said step of tracking modified 
profiles with a third database tool, said third database tool comprises a Profile Mai 
said Profile Matrix comprises a data set. 



3, (Original) The method of claim 2, wherein in said step of tracking modifications of said 
profiles with a third database tool, said third database tool allows tracking capability of tasks 
required to gather and implement changes to said profiles. 

4, (Original) The method of claim I, wherein in said step of gathering requirements of said 
profiles with a second database tool, said second database tool comprises a profile requirement 
worksheet, wherein said profile requirement worksheet identifies said data. 

5, (Original) The method of claim 1 ? wherein in said step of gathering requirements of said 
10/015,256 19 
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profiles with a second database tool, said second database tool further identifies authorization 
objects and field values of said profile requirement worksheet necessary to gather said 
requirements of said profiles. 

6. (Original) The method of claim 1, wherein said step of creating said profiles with a first 
database tool further comprises editing said profiles. 

7. (Original) The method of claim 6, wherein in said step of creating said profiles with a 
first database tool, said first database tool comprises a security and authorization profile change 
request database, wherein said security and authorization profile change request database allows 
said authorization users and requestors an ability to view documented progress of queries of said 
profiles. 

8. (Previously Presented) A computer system executing a method for tracking custom 
computer application development profiles in a data processing system, said system comprising: 

a first database tool; 

a second database tool connected to said first database tool; 
a third database tool connected to said first and second database tool; 
a data bank connected to said first, second and third database tool; and 
a security and authorization interface connected to said data processing system, 
wherein said first database tool comprises a first set of protocols which create said 
profiles, 

wherein said second database tool comprises a second set of protocols which gather 
10/015,256 20 
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requirements of said profiles, 

wherein said third database tool comprises a third set of protocols which track 
modifications of said profiles; and 

wherein said third database tool is adapted to determine whether breaches in security of 
said data processing system has occurred in each phase of development of a computer 
application program. 

9. (Original) The computer system of claim 8, wherein said third database tool comprises a 
Profile Matrix, and wherein said Profile Matrix comprises a data set. 

10. (Original) The computer system of claim 9, wherein said third database tool allows 
tracking capability of tasks required to gather and implement changes to said profiles. 

1 1 . (Original) The computer system of claim 8, wherein said second database tool comprises 
a profile requirement worksheet, and wherein said profile requirement worksheet identifies said 
data. 

1 2. (Original) The computer system of claim 8, wherein said second database tool further 
identifies authorization objects and field values of said profile requirement worksheet necessary 
to gather said requirements of said profiles, 

13. (Original) The computer system of claim 8, whereiii said first database tool edits said 
profiles. 

10/015,256 21 



PAGE 22/26 * RCVD AT 9/112005 10:45:44 AM [Eastern Daylight Time] * SVR:USPTO-EFXRF-6/28 * DNiS:2738300 * CSID:4105731124 * DURATION (mm-ss):07-54 



08/31/2005 22:44 4105731124 MCGINN&GIBB PAGE 23 



14. (Original) The computer system of claim 13, wherein said first database tool comprises a 
security and authorization profile change request database, and wherein said security and 
authorization profile change request database allows said authorization users and requestors an 
ability to view documented progress of queries of said profiles, 

15. (Previously Presented) A program storage device readable by machine, tangibly 
embodying a program of instructions executable by the machine to perform a method for 
tracking custom computer application development profiles in a data processing system, said 
method comprising: 

creating said profiles with a first database tool; 
gathering requirements of said profiles with a second database tool; 
tracking modifications of said profiles with a third database tool; 
allowing security and authorization users access to said profiles; and 
detennining whether breaches in security of said data processing system has occurred in 
each phase of development of a computer application program. 

1 6* (Original) The program storage device of claim 1 5 , wherein said third database tool 
comprises a Profile Matrix, and wherein said Profile Matrix comprises a data set. 

17. (Original) The program storage device of claim 16, wherein in said method, said step of 
tracking modifications of said profiles with a third database tool allows tracking capability of 
tasks required to gather and implement changes to said profiles. 

10/015,256 22 
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1 8. (Original) The program storage device of claim 1 5, wherein said second database tool 
comprises, a profile requirement worksheet, .and wherein said profile requirement worksheet 
identifies said data, 

1 9. (Original) The program storage device of claim 1 5 , wherein said second database tool 
fbrther identifies authorization objects and field values of said profile requirement worksheet 
necessary to gather said requirements of said profiles. 

20. (Original) The program storage device of claim 15, wherein in said method, said step of 
creating said profiles with a first database tool further comprises editing said profiles. 

2 1 . (Original) The program storage device of claim 20 s wherein said first database tool 
comprises a security and authorization profile change request database, and wherein said security 
and authorization profile change request database allows said authorization users and requestors 
an ability to view documented progress of queries of said profiles. 
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IX. EVIDENCE APPENDIX 

There is no other evidence known to Appellants, Appellants' legal representative or 
Assignee which would directly affect or be directly affected by or have a bearing on the Board's 
decision in this appeal. 
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X. RELATED PROCEEDINGS APPENDIX 

There are no other related proceedings known to Appellants, Appellants' legal 
representative or Assignee which would directly affect or be directly affected by or have a 
bearing on the Board's decision in this appeal. 
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